Privacy Policy

Who we are

DC Warrington Ltd ("we", "us", "our") is a performance tuning business specialising in BMW and VAG platform vehicles. We operate from:

We are the data controller for the personal information collected through this website and our business operations. This policy explains what personal data we collect, why we collect it, and what rights you have in relation to it.

This policy applies to all visitors to our website and all customers and enquirers who contact us. It is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data we collect

We collect personal data in the following ways:

Information you give us directly

When you submit a quote request, book an appointment, contact us by email or phone, purchase a gift card or product from our shop, or apply for finance, you may provide:

• Your name
• Email address
• Phone number
• Vehicle registration number and vehicle details (make, model, engine, modifications)
• Address (for invoicing or finance purposes)
• Payment information (processed by our payment provider, we do not store card details)
• Any additional information you choose to include in your message

Information collected automatically

When you visit our website, we and our third-party service providers automatically collect certain technical information, including:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring website or search terms used to find us
• If you accept cookies: which of our adverts, or which website, brought you to us (see section 5)
• Date and time of your visit

This information is collected via cookies and similar tracking technologies. See section 5 for full details.

Information from third parties

We may receive information about you from third parties such as finance providers if you apply for 0% finance through our website.

How we use your data

Purpose	What we do	Lawful basis
Responding to enquiries	We use your name, email, phone and vehicle details to respond to quote requests and general enquiries	Legitimate interests / Pre-contractual steps
Booking & appointment management	Confirming, managing and following up on tuning appointments	Contract performance
Providing our services	Carrying out ECU remapping, gearbox tuning, diagnostics and related services	Contract performance
Invoicing & payment	Raising invoices, processing payments and maintaining financial records	Contract performance / Legal obligation
Finance applications	Passing relevant information to our 0% finance provider to process your application	Consent / Contract performance
Improving our website	Using analytics data to understand how visitors use our site and improve the experience	Legitimate interests
Targeted advertising	Using Facebook Pixel data to show relevant ads to people who have visited our website	Consent (via cookie consent)
Measuring our advertising	Recording which advert or website brought you to us, and telling Google and Meta when an enquiry, booking or order follows one of their adverts, so we can see which adverts work	Consent (via cookie consent)
Legal compliance	Maintaining records as required by law (e.g. HMRC, Companies House)	Legal obligation

We will never sell your personal data to third parties, and we will never use it for purposes incompatible with those described above without first obtaining your consent.

Lawful basis

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Contract performance

Where processing is necessary to fulfil a contract with you, or to take steps at your request before entering into a contract, for example, handling your booking or providing the tuning service you have paid for.

Legitimate interests

Where we have a legitimate business interest in processing your data, provided this does not override your rights and interests. This covers responding to enquiries, basic website analytics, and following up with customers after a service.

Legal obligation

Where we are required by law to process your data, for example retaining financial records for HMRC purposes.

Consent

Where we use non-essential cookies (including Facebook Pixel and analytics cookies), and for the related sharing with Meta described in section 5, we ask for your consent via our cookie banner before activating them. You may withdraw consent at any time.

Cookies & tracking

Our website uses cookies, small text files stored on your device. We use the following categories:

Strictly necessary cookies

These are required for the website to function and cannot be switched off. They include the setting that remembers your cookie choice, and security cookies our hosting provider (Cloudflare) may set to protect the site.

Analytics cookies

We use Google Analytics to understand how visitors use our website (e.g. which pages are most visited, how long visitors stay). Its cookies are only placed if you accept them. We also use Cloudflare Web Analytics, which does not use cookies and does not identify you personally.

Marketing cookies (Facebook Pixel and Google Ads)

Our website uses the Facebook Pixel (ID: 698779918025949), a tracking tool operated by Meta Platforms Ireland Ltd. The Pixel allows us to:

• Measure the effectiveness of our Facebook and Instagram advertising
• Show relevant ads to people who have previously visited our website (remarketing)
• Build custom audiences for advertising on Meta platforms

The Pixel sends browsing data to Meta. Meta may transfer this data to servers outside the UK. For more information, see Meta's Data Policy. These cookies are only placed with your consent.

We also use Google Ads conversion tracking. Its cookies tell us when someone who clicked one of our Google adverts goes on to book or send an enquiry. They are only placed with your consent.

Where you came from (our own record)

If you accept cookies, our website keeps a small record on your device of how you arrived: which of our adverts, which search engine or which website sent you, the advert's campaign name and the first page you saw. It is kept for 30 days and then deleted. If you book, order a mail-in unlock or send us an enquiry, this record is sent with it, so we can see which adverts lead to bookings. If you decline cookies, nothing is stored on your device; we only see where you came from if the page you book or enquire on shows it: its web address, or the website that linked straight to it.

Sharing enquiries and bookings with Meta (Conversions API)

If you accept cookies and then send us an enquiry, book, or pay for a mail-in unlock, our booking system also tells Meta about it directly, so it is counted even if your browser blocks the Facebook Pixel. We send your email address, phone number, name and postcode district in a scrambled (hashed) form, your IP address and browser type, the Facebook cookie identifiers, and what you booked and its value. Meta uses these details to match the enquiry or booking to an advert shown on Facebook or Instagram, so we can measure which adverts work and Meta can improve how our adverts are shown. If you decline cookies, nothing is sent to Meta in this way.

Third parties

We share data with third parties only where necessary. The main parties are:

Third party	Purpose	Data shared
Cloudflare	Website hosting, security and our online booking system	Everything submitted through the website and booking system; technical visitor data such as IP address and browser type
Web3Forms	Delivering quote, contact and finance form submissions to our inbox	Everything you enter on those forms
Google	Our email and booking diary (Google Workspace); website analytics (Google Analytics); advertising measurement (Google Ads); embedded maps, YouTube videos and fonts	Booking and contact details (email and diary); browsing data, with analytics and advertising cookies only if you accept them
Meta (Facebook, Instagram, WhatsApp)	Advertising and remarketing via the Facebook Pixel; measuring our adverts via the Conversions API; messages you send us on Facebook, Instagram or WhatsApp	Only if you accept cookies: browsing data (Pixel), and for enquiries and bookings your hashed email, phone, name and postcode district, IP address and browser type. The messages and details you send us on Meta’s apps
ManyChat	Automated replies to messages and comments on our Instagram and Facebook pages	Your social media name and the messages you send
Stripe	Taking booking deposits and payments (card, Apple Pay and Klarna at checkout)	Name, email, booking details and payment data. Card details are handled by Stripe and never stored by us
Klarna	Pay in 3 at checkout, if you choose it	The details Klarna needs to set up and manage your payment plan
Bumper	Finance applications, if you apply to spread the cost with Bumper	Name, contact details, address, vehicle registration and the amount of the job
DVLA and our vehicle data supplier	Identifying your car from its registration so we can show the right figures and price	Vehicle registration number only
Bouncer (EU-based email verification)	Checking that an email address entered on our forms can receive email, so our reply reaches you	Email address only

All third parties we work with are required to handle your data securely and in accordance with applicable data protection law. We do not sell personal data to third parties for their own marketing purposes.

Your vehicle’s records if you sell it

We keep records of the work we carry out on your vehicle. We will not share them with a later owner of the vehicle, a dealer or anyone else, or confirm that we worked on it, unless you ask us to. To give permission, email sales@dcremappinguk.com from the email address we hold for you, with the registration and the name of the person we may share the details with. See section 25 of our Booking Terms.

International transfers

Some of our third-party providers (including Google, Meta, Stripe and Cloudflare) may transfer data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK ICO, or we rely on the provider's ICO-recognised adequacy mechanisms.

How long we keep it

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law:

Data type	Retention period	Reason
Customer records (name, contact details, vehicle, service history)	6 years after last interaction	Statutory limitation period for contract disputes
Financial / invoicing records	6 years from end of the relevant tax year	HMRC requirement
Enquiry emails (where no booking results)	12 months	Legitimate interest in following up
Website analytics data	Up to 14 months (the Google Analytics maximum)	Understanding website performance
Cookie consent records	12 months	Demonstrating compliance
Where you came from (stored on your device, only if you accept cookies)	30 days	Measuring which adverts lead to bookings

When data is no longer required, it is securely deleted or anonymised.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, contact us using the details in section 10. We will respond within one calendar month. We do not charge a fee for reasonable requests.

Security

We take the security of your personal data seriously. Measures we have in place include:

• All data transmitted between your browser and our website is encrypted using TLS (HTTPS)
• Our website and booking system run on Cloudflare, which holds ISO 27001 certification and SOC 2 Type II reports
• Access to customer data is restricted to those who need it to perform their role
• We do not store payment card details, payments are processed by PCI-DSS compliant third-party providers

No method of electronic transmission or storage is 100% secure. If you believe your data has been compromised, or if you suspect a security incident relating to our business, please contact us immediately at sales@dcremappinguk.com.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay where required by law.

Contact & complaints

If you have any questions about this privacy policy, wish to exercise your data rights, or have a concern about how we handle your personal data, please contact us:

Making a complaint

We hope to resolve any concern you raise directly. However, if you are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection regulator:

Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will always show when it was last revised. Where changes are significant, we will take reasonable steps to notify you.